Jump to content

Malwarebytes blocking outbound website

Recommended Posts

I have a pc that has started acting up - IE randomly opening up with random websites, running very slow, etc. I have run Malwarebytes, Kaspersky and use ESET antivirus but none of these find anything. Malwarebytes keeps popping up letting me know that is it blocking a malicious website ( when IE is not even running.


I followed the steps under the forum "I'm infected - What do I do now" and ran farbar recovery tool. The log files it created are attached.


Hope you can help me.




Link to post
Share on other sites

Hello and post-32477-1261866970.gif


P2P/Piracy Warning:



If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.





Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.


Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.




Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.



Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.


When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.



In most cases, a restart will be required.



Wait for the prompt to restart the computer to appear, then click on Yes.



Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.




Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number




thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.




Download Dr Web Cureit from here http://www.freedrweb.com/cureit save to your desktop. (Scroll to bottom of page)


  • The file will be randomly named
  • Reboot to safe mode
  • Run Dr Web
  • Tick the I agree box and select continue
  • Click select objects for scanning
  • Tick all boxes as shown
  • Click the wrench and select automatically apply actions to threats
  • Press start scan
  • The scan will now commence
  • Once the scan has finished click open report
  • A notepad will open
  • Select File > Save as..
  • Save it to your desktop


This log will be excessive,  Attach it to your next reply…


Let me see those logs in your next reply, also give an update on any remaining issues or conceerns....









Link to post
Share on other sites

I was able to do almost everything. I could not download and run drwebcureit (tried in safe and normal modes. It wouldn't download). Here is everything else:

Malwarebytes log: I have attached as a txt file because unable to paste from clipboard

adwcleaner log: again attached because unable to paste

Junkware removal log: attached - same issue (very sorry...)




Link to post
Share on other sites

We still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:


Run Eset Online Scanner


**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin.


(To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART  Installer during the process)


Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.


Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats"  is UNticked
Click on Advanced Settings, ensure the following options are checked:
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish


When the scan is complete


If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found


If threats were found


click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish


close program


Copy and paste the report in next reply, also give an update on any remaining issues or concerns..



Link to post
Share on other sites

ESET log entry is safe, nothing to worry about.. run the following, let me know if the outbound IP block ceases...


51a612a8b27e2-Zoek.pngScan with ZOEK


Please download ZOEK by Smeenk from here: http://hijackthis.nl/smeenk/ and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.


Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.
In the main box please paste in the following script:





Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)


Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!





Link to post
Share on other sites

Do the following links give any information that you recognize related to the blocked IP..








I want you to restart your system in a "clean boot mode" basically this will disable all non microsoft services, make sure your security is left active if listed....

See if the IP block occurs in that mode, instructions are at the following link, expand the option for Windows 7...







Link to post
Share on other sites

The warning blocking the IP address seems to have stopped. Have not had it pop up for several days. PC seems to still run slow and today got an "application security warning"  that couldn't start an application because too many things were already running. The only applications started were Outlook 2013 and Excel 2013.



Link to post
Share on other sites

If the clean boot has fixed the IP issue do the following:


Repeat clean boot instructions again, ensure all MS services are hidden, enable half of the non MS services then re-boot. If the issue does not return do exactly the same again, this time only enable the bottom half of non MS services.

If the issue returns we know the issue is in the bottom half, so you now repeat again but only enable half of the bottom half. Keep doing that until you isolate the rogue sevice.


Let me know how you get on, I know it is a laborious task but it will locate the issue.




Link to post
Share on other sites

Now this morning while checking email a random video opened up and started playing (screen shot attached - I could not find any information as far as ip address, etc as to where the video came from)


Also got 19 ESET warnings - screenshot attached of that as well.


Thanks for all of your assistance.




Link to post
Share on other sites

Sorry to keep posting but realized that Malwarebytes was not running because it was disabled during the clean boot. I restarted it again now and the warnings about blocking the outbound IP address started back up again.


Then got 4 more Application Run-Security Warnings

Attached are the screen shots I took







Link to post
Share on other sites

Scan with Gmer rootkit scanner


Please download Gmer from Here by clicking on the "Download EXE" Button.


  • Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
            Show All ( should be unchecked by default )
  • Leave everything else as it is.
  • Close all other running Programs as well as your Browsers.
  • Click the Scan button & wait for it to finish.
  • Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop.


Please post the content of the ark.txt here.




Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries


**If GMER crashes** Follow the instructions here and disable your security temporarily…




Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/


Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
Post back the report which should also be located here:
C:\Programdata\RogueKiller\Logs <-------- W7/8
C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <-------XP


Let me see those logs please...

Link to post
Share on other sites

Logs are ok, not malicious...


Do you have access to another PC to create the Widows Defender Offline Tool, I give the instructions to load to a USB flash drive. It can also be loaded to a CD,

Download the tool from here :- http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline and save to the Desktop.

You will have to select the correct version for your system, either 32 or 64 bit

Run the tool, Windows 7 or Vista user right click and select "Run as Administrator"

Read the instructions in the new window and select "Next"




In the new window accept the agreement:




In the new window select your USB Flash Drive, then select "Next"




In the new window ensure you Flash drive is selected, if not click on "Refresh" then select "Next"




In the new window accept the formatting alert by selecting "Next"




Files will be Downloaded:




Files will be processed and created




Flash drive will be formatted and prepared




Files will be added to the Flash Drive and the tool will be created.




The procedure is finished and the Tool created, click on "Finish" to complete.




Plug the USB into the sick PC and boot up, if it does not boot from the flash drive change the boot options as required,  Use F12 as it boots, change options...

As it boots you`ll see files being loaded and the windows splash screen, eventually the tool will run a "Quick Scan" follow the prompts and deal with what it finds.

When complete do a full scan, deal with what it finds.

When finished, remove the USB stick then press the Esc key to boot into regular windows.

Navigate to the following file:


"C:\Windows\Windows Defender Offline\Support\MPLog-MM/DD/YYYY-HH/MM/SS .txt"


Open with notepad and copy and paste it into a reply.





Link to post
Share on other sites

This is frustrating for sure, ok run the following:


Read the following link before we continue and run Combofix:

ComboFix usage, Questions, Help? - Look here


Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-



  • Ensure that Combofix is saved directly to the Desktop <--- Very important
  • Disable all security programs as they will have a negative effect on Combofix, instructions available here  http://www.bleepingcomputer.com/forums/topic114351.html if required. Be aware the list may not have all programs listed, if you need more help please ask.
  • Close any open browsers and any other programs you might have running
  • Double click the combofix.gif icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
  • Instructions for running Combofix available here http://www.bleepingcomputer.com/combofix/how-to-use-combofix if required.
  • If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
  • When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read here  http://thespykiller.co.uk/index.php?page=20 why  disabling autoruns is recommended.


  • If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
  • If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
  • If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...


Link to post
Share on other sites

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the Codebox below into it:


Save this as CFScript.txt, and as Type: All Files (*.*) in the same location as ComboFix.exe



Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply




Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:


64 Bit version:



Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Full Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:


1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter

notepad c:\windows\debug\mrt.log


Let me see those logs, also give update on any remaining issues or concerns....





Link to post
Share on other sites

Download Portable Windows Repair (all in one) from one of the following:






Unzip the contents into a newly created folder on your desktop.


Open the folder, run the tool by right click on Repair_Windows (icon with red briefcase) select "Run as Administrator"





From the main GUI do the following:



Select Tab 3 and allow it to run Disk check





Select Tab 4 and allow it to run SFC





Select Tab 5 and Create System Restore Point





Select Start Repairs tab => Click the Start





The repairs window will open, Check the boxes as indicated, also the "Restart" option, then select Start...





DON'T use the computer while each scan is in progress.


Post the log, to access select "settings" tab > "open log folder" tab, log will be named _Windows_Repair_Log






Let me see that log,  do we see any improvement?



Link to post
Share on other sites

Earlier in the thread when you noted Malwarebytes was still off, turning it back on reintroduced the IP block issue,  was the system still in a Clean Boot mode or back in Normal mode?




Download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe      <<-   64 bit….

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe  <<-  32 bit

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :regfind*setup.application**Digital plugin SL*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt



Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.